Week of August 7 – August 15, 2026
The Network Learned to See Agent Traffic, and It Learned by Guessing
Last week ended on a sentence I have now written so many times I am starting to sound like a broken record: you cannot govern what you cannot observe. I meant it as a complaint. The agent economy was being run out of edge configuration and response bodies, and the only way to see any of it was to impersonate a crawler and read a status code.
This week the observability arrived. I did not expect it to arrive nine days later, and I did not expect it to arrive in this shape.
Cloudflare Gateway can now spot Model Context Protocol traffic crossing your network. Fingerprint published a guide to working out which AI tool is calling your MCP server. OWASP has an MCP Top 10, and Apollo went through it in public. The network layer learned to see the agent layer.
Cloudflare identifies MCP requests “by inspecting protocol-specific headers and payload characteristics” — what their own security post calls protocol-level heuristics. That is not a declaration. That is a very good guess about what a payload probably is. We have built the entire visibility layer for agent traffic on inference, for the same reason we ended up with User-Agent as a billing identity: the traffic will not tell us what it is, so we squint at it.
And then, in the same week, Google did the opposite thing.
The Network Learned to See MCP, and It Sees by Inference
For a year MCP traffic has been invisible to the people responsible for the network it crosses. This week that stopped.
- Cloudflare Gateway now automatically detects MCP traffic, shipped alongside an AI Security dashboard. The changelog is refreshingly plain about the method: Gateway “identifies MCP requests by inspecting protocol-specific headers and payload characteristics.”
- The longer security write-up is the one to read, because it names the actual customer problem: shadow MCP traffic. Security teams can use the detection signal to find MCP servers nobody told them about, enforce Portal-only access for approved ones, and block direct connections on managed networks. Shadow IT has been rebooted, on a fifteen-year cycle, exactly on schedule.
- Fingerprint went one level deeper — how to detect which AI tool is calling your MCP server. Not whether it is an agent. Which agent.
- Apollo published where its MCP Server stands against the OWASP MCP Top 10. The headline here is not Apollo’s scorecard, it is the existence of the list. A protocol gets an OWASP Top 10 when enough people have been hurt by it to sort the wounds into categories.
- Gravitee walked through securing the GitHub MCP server, opening with a platform team whose triage agent read issues, labelled them, and assigned owners — the kind of quietly over-privileged agent that is now in production everywhere.
- Kiteworks put a “Secure MCP Server” on Anthropic’s Connector Marketplace, with a framing I thought was honest: most enterprises did not decide to expose sensitive data to models, they backed into it one well-intentioned prompt at a time.
- And the identity thread from last week kept running. WorkOS wrote the sharpest piece of the week on how an MCP client should tell your OAuth server who it is: Dynamic Client Registration is deprecated, Client ID Metadata Documents answer only half the question, and
auth.mdcovers the user delegation both leave out.
Put the WorkOS post next to the Cloudflare one and you can see the seam. WorkOS is working on how a client declares itself. Cloudflare is working on how the network deduces what a client is, because most clients declare nothing. Both are necessary. Only one of them is a foundation. Heuristics are how you cope with an undeclared world, and every control built on top of them inherits their error rate — a false negative is shadow traffic you never saw, and a false positive is a blocked request from a service that merely looked like an agent. We are going to spend the next two years discovering the base rates.
The AI Gateway Consolidated, and Google Put the Router in an OpenAPI
Two weeks ago the MCP gateway became a product category. This week the model gateway consolidated, and the interesting part is where the configuration ended up.
- Google Cloud API Gateway shipped model routing in Public Preview — dynamic routing to Gemini, Claude, or OpenAI’s OSS-GPT without hardcoding endpoints or running your own proxy. And here is the line I want you to notice: the routing rules are configured directly in your OpenAPI 3.x specification, mapping virtual model names to backend targets. The AI layer just became something you declare in an API contract.
- Cloudflare unified Workers AI and AI Gateway into a single control plane — one binding and one REST API for first-party and third-party models, with observability, logging, caching, security, and billing in one place. When access and billing unify, a category has stopped being a feature.
- Microsoft’s new API Management AI Gateway tier got a good practitioner write-up, and it is a useful inventory of what this box now does: model access, token limits, semantic caching, token metrics, and the MCP traffic contract.
- Kong applied NVIDIA’s NeMo Switchyard across model traffic in its AI Gateway, and NVIDIA published the underlying case for routing agent workloads across models: each model has its own strengths and cost profile, and those shift underneath you.
The through-line with the first section is exact, and it runs the other way. Cloudflare’s MCP detection asks the network to infer what traffic is. Google’s model routing asks the provider to declare where traffic goes, in a document that already exists, in a format that already has tooling, versioning, diffing, and governance. One of those approaches degrades when the payload changes. The other one is a contract.
I have spent years arguing that OpenAPI is the substrate everything else should hang off. I did not expect the strongest recent evidence to be an AI model router. But that is what a substrate looks like when it works: somebody solves a brand-new problem and reaches for the boring document because it is already there.
I also spent an hour this week talking to someone who has been building the box itself. My conversation with Lin Sun on gateways for the agentic AI era is below in the desk section, and her framing is the one I keep returning to while writing this issue: AI workloads are “microservices plus.” Same policy, security and observability problems, plus dynamic protocols like MCP and A2A that change underneath you — which is exactly why she thinks the gateway stays a control point rather than getting designed away.
📄 Change on the Agent Surface — Governing versioning, breaking changes, and deprecation for the MCP tools an agent binds to. Your API has a versioning policy. Your MCP server almost certainly does not, and an agent that bound to a tool last month has no way to learn that its arguments moved. $25
MCP Servers Stopped Being Announcements
I counted twenty-four MCP server launches in the corpus this week. I am not going to list them all, because the point is that listing them has stopped being interesting.
- The shape of the week: Zoho Expense, Kubeflow, Nutanix, Octopus Deploy, Songstats, Vitally, CompanyCam in beta, and Apache Camel folding MCP into Camel 4.22. An expense tool, a Kubernetes ML platform, a hyperconverged infrastructure vendor, a deployment tool, a music analytics service, and a construction photo app. There is no longer a market segment where this is notable.
- The more telling ones are the second posts — the features, not the launches. Alpaca’s trading MCP server added documentation access. Buildkite’s can now find your slowest and flakiest tests. Svix shipped an App Portal MCP server so your customers can debug the webhooks you send them without leaving their editor — which is a genuinely good product idea that happens to be delivered over MCP. Cisco wired up Meraki and Catalyst Center, MuleSoft documented connecting its platform server to Claude Code, and n8n made one-click connections to seventy of them, with a section on when not to use them.
- SmartBear put its MCP server on Amazon Bedrock AgentCore as one interface across API contracts, test coverage, and production signal, and separately argued for reducing governance fragmentation with Swagger across multiple protocols.
- Then the bill arrived. Gravitee published “v2 to v4 Migration: Why MCP and Agents Only Live on v4”, and it opens on a scene every platform team will recognise: someone asks to expose an API to an agent, it sounds like a small ask, and then somebody checks which API definition it is running on and the whole conversation changes. MCP has become a forcing function for platform upgrades people deferred for years.
- And the measurement I have been waiting for: APImatic benchmarked OpenAPI versus MCP versus context plugins across the same recurring-billing integration. Every condition completed the functional task and passed the contract checks. The differences were entirely operational — resilience, error hygiene, configuration behaviour, API-drift handling, wire coupling, and how much effort it took to learn the API.
That last result deserves more attention than it will get. When four different integration approaches all work, the choice between them is not about capability, it is about what happens on a bad day. Which one survives a schema change. Which one fails loudly. Which one you can debug at 2am. That is the entire argument for specifications, and it is very hard to sell, because the benefit only shows up in the incident you did not have.
So I went looking for a market where the bad day is not hypothetical, and republished The State of US Healthcare APIs at version 2.0 on Saturday. Twenty-one of the seventy-five companies scored there run their own MCP server — twenty-eight percent, ahead of most of the catalog. Not one of them describes a multi-step workflow. Consent and delegated identity, the semantics an agent needs to act on behalf of a patient, is unsatisfied across 96% of the market. Documented idempotency — the guarantee that a retried call does not book the appointment twice or send the prescription twice — is unsatisfied at 91%. These organisations have elaborate consent machinery and careful retry handling. What almost none of them have done is declare either one in a form a program can read, which puts them back on the wrong side of the same seam: an agent arrives, finds a tool it can call, and has to infer everything that governs whether calling it is safe. The companies making those mandates usable are the ones publishing the most here, and the report names every one of them.
HTTP 402 Grew a Leaderboard
Two weeks ago I went looking for ads served to AI agents and instead found publishers using HTTP 402 Payment Required as a toll gate — 17% of media properties gating at least one AI vendor. That was 402 used as a wall. This week I watched the other version of 402 mature, and it is a market.
- Algorand published a best-practices guide for enabling x402 payments — integrating the payment flow, using a facilitator to verify and settle, making the service discoverable, and standing up a demo. Note the last item in their list: gating an ordinary Web2 API behind crypto payment instead of API keys or subscriptions. That is a direct swap of the entire access-control model.
- Then the sentence that made me sit up. Algorand also published a troubleshooting guide titled “Is your x402 endpoint showing up in the facilitator leaderboard?” — written because the same question kept landing in their inbox: payments settle, the API responds correctly, and yet the endpoint does not appear. There is now a discovery layer for machine-payable endpoints, and providers are already filing support tickets about their ranking in it. I have spent fifteen years asking for an API discovery layer. One materialised in a month because money was attached.
- NOWNodes wrote the clearest explainer of the protocol: an open standard letting a site, an API, or an agent charge for a request directly over HTTP, settling in stablecoins, by finally using the status code the web reserved and never shipped.
- The enterprise version showed up too. Solv Labs built verifiable, auditable agent payments on Amazon Bedrock AgentCore — every transaction authorized, attested in a Nitro Enclave, priced for risk, and anchored to a public chain before settlement. That is what “an agent spent money” has to look like in a regulated environment.
- And the demand side got named: Algorand on what enterprise leaders need to know about agentic commerce — a buyer that does not browse, does not hesitate, and does not need a checkout page built for humans — with Stitch reporting from South Africa that AI-referred shoppers convert at nearly 50% higher rates than organic search.
Hold the two 402s side by side, because they are the same status code pointed in opposite directions. The publisher 402 is defensive: an incumbent using payment-required to keep an agent out until somebody signs a licensing deal. The x402 402 is generative: a provider using payment-required to let an agent in without ever creating an account. One is a wall with a lawyer behind it. The other is a door with a price on it. My honest read is that the second one is a far bigger deal for anyone who publishes an API, and it is getting a fraction of the attention, because it arrived wearing crypto clothes that a lot of sensible people have learned to walk past.
From My Desk: I Pointed the Crawler at Myself
After two weeks auditing how other people serve agents, I ran the same tooling against my own network. It did not go well, and that was the useful part.
- Every ad on my network was invisible to agents. I had spent an afternoon documenting how Time serves ads to AI agents and forming strong opinions about which parts nobody should copy — then I looked at my own properties and found my advertising rendered in a way no agent ingesting my pages would ever see. I have been writing about the agent surface for a year while my own commercial layer was human-only.
- A conversation with Lin Sun on gateways for the agentic AI era, open source, and donating projects to the CNCF. Lin is Head of Open Source at Solo.io, an Istio co-founder, a recent CNCF Technical Oversight Committee member, and a KubeCon co-chair. We covered the leap from fifteen years at IBM to a thirty-person startup, donating Gloo to the CNCF as kgateway, launching kagent, and building Agent Gateway from the ground up for MCP and A2A rather than retrofitting an HTTP proxy. The part I did not expect: her argument that a gateway can absorb a breaking specification change on behalf of its users — which, in a protocol still moving this fast, is a real answer to the versioning problem I have been complaining about all year. She closes on hard-won advice for taking a project through CNCF sandbox, incubation and graduation.
- The onboarding series ran all week and it is becoming a genuine body of evidence: Kinde has the plumbing and skips the front door, Cloudflare hands you a token only after you click through the dashboard, Akamai can mint its own credentials if you already have one, even Stripe makes you click a button — and then, finally, Twilio is what programmatic onboarding looks like when a company means it. Every company in this industry says agents are the future. Almost every one of them opens with a CAPTCHA.
- The Overlays series continued with monetization and plan tiering from one spec, MCP and AI-agent enrichment, and deprecation and migration choreography — that last one directly relevant to the Gravitee migration story above.
- The Specification Layer launched — a second weekly newsletter, out Mondays, covering what actually changed inside the thirty specification repositories the Linux Foundation stewards, rather than what vendors wrote about them. Nobody else covers that, so now I do.
- The Germany series finished with a playbook for US agencies and a playbook for Europe on eIDAS, sovereignty, and a shared GovTech ecosystem. Nine posts, one blueprint, and a conclusion I keep landing on: the US owns nearly every ingredient and has assembled none of them.
- Two pieces on where governance actually lives: context engineering is governance, and Agent Skills as a bridge between engineering and product. Plus the excuses file — we have partner APIs, not public APIs and if we publish our documentation our competition will copy us — alongside does your API game live up to your AI hype, markdown became the control plane for AI, your AI bill will be your cloud bill on steroids, GraphQL as connective tissue, the tools that actually execute your Arazzo workflows, why isn’t the surface area of a VC portfolio programmable, agents turn broken auth into a breach at machine speed, and Swagger was a config file until we made it a format.
The thing I take out of my own audit is the thing this whole issue keeps circling. I could not see my own commercial layer through an agent’s eyes until I built a tool that looked. Cloudflare’s customers could not see MCP crossing their networks until Gateway learned to guess at it. Algorand’s developers cannot see whether their paid endpoint is discoverable without checking a leaderboard. Every one of these is the same gap: we are operating a machine-to-machine economy with instrumentation built for humans, and we keep discovering the gap by accident, one audit at a time.
The fix is not more detection. Detection is the workaround. The fix is the thing Google quietly did this week — put the fact in the contract, where it can be read, versioned, and checked, instead of inferred from the shape of a payload.
See you next week.
📄 The State of US Healthcare APIs — Republished at version 2.0 this week. 75 US healthcare companies scored on the same rubric applied to Stripe, Twilio and GitHub — every one named and banded. The most standardised market in this research and the least programmable one: a Kin Score median of 38.9 against 53.8 for revenue software and 49.1 for marketing, neither of which is regulated at all. 57% publish a machine-readable contract, 28% run their own MCP server, 31% document an event surface, and none describe a multi-step workflow. Thirty years of mandated machine-to-machine standards produced clearinghouses, not APIs — and the report maps exactly where the programmable layer sits. $500
